Understand what the security scan checks

Every skill on verified-skill dot com goes through a four-stage security scan. Patterns. AI. Dependencies. Provenance. Here's what each stage actually does.

An AI skill is code your agent will execute on your behalf. One bad prompt, one malicious dependency — the blast radius is your whole machine. So we don't ship a skill until four independent checks have signed off.

Stage one — pattern scan. Thirty-seven security patterns, regex-tight, run in milliseconds. Stage two — L L M analysis. The model reads the skill and flags intent that doesn't match the description. Stage three — dependency audit. Every npm package is scored against the public risk index. Stage four — provenance check. We verify the author owns the repo and the published bundle matches the source. Four passes. One verdict.

All four pass — the skill ships. Any one fails — it doesn't. No exceptions. No overrides. No 'we'll fix it in production'.

Browse verified skills at verified-skill dot com. Every card you see has cleared all four stages. Trust by construction.

The narration as voiced in the video.